VYPR
← All advisories
Medium severity5.0OSV Advisory· Published Nov 28, 2025· Updated Apr 15, 2026

CVE-2025-66371

CVE-2025-66371

Description

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
peppol_pyPyPI
< 1.1.11.1.1

Affected products

1

Patches

1
349a4bff8adb

Prevent Saxon URL access, avoids XXE vulnerabilities (#16)

https://github.com/iterasdev/peppol-pyHanno BöckNov 13, 2025via ghsa
commit
1 file changed · +2 −0
  • src/peppol_py/validation.py+2 −0 modified
    @@ -28,6 +28,8 @@ def validate_peppol_document(
     # only works with XSLT 1.0, and the Schematron is written in XSLT
     # 2.0
     with PySaxonProcessor(license=False) as proc:
+        # Prevent XXE: disallow access to any type of URL
+        proc.set_configuration_property("http://saxon.sf.net/feature/allowedProtocols", "")
         for validation_xsl_file in schematron_xsls:
             if not os.path.exists(validation_xsl_file):
                 # Resolve internal files

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.